Overview
We are given a corrupted file null.png and a decoy file try_me.png. We must repair the PNG headers of null.png to open the image and recover the flag.
Reconnaissance
Running the file command on null.png reports it as raw data.
Inspecting the hex bytes of null.png, the PNG signature is valid (89 50 4E 47 0D 0A 1A 0A), but the 4-byte IHDR chunk type identifier at offset 12 is corrupted (modified to 94 84 52 25).
Exploitation Strategy
We wrote a Python script to fix the 4 bytes at offset 12 back to IHDR (49 48 44 52).
Since the chunk type changed, the original IHDR CRC checksum is now invalid. We recalculated the CRC checksum for the modified IHDR chunk (bytes 12-28) using zlib.crc32 and wrote it back into the file.
The repaired image opened successfully and revealed the flag. (Note: decoding the metadata tEXt chunk using Base32 also confirmed the hints).
Solution Code
import zlib, struct
with open('null.png', 'rb') as f:
d = bytearray(f.read())
# Fix IHDR chunk type
d[12:16] = b'IHDR'
# Recalculate CRC
ihdr_crc = zlib.crc32(bytes(d[12:29])) & 0xffffffff
d[29:33] = struct.pack('>I', ihdr_crc)
with open('null_fixed.png', 'wb') as f:
f.write(d)
# Open null_fixed.png to read flag:
# Flag: CrackOn{png_headers_fixed_timeline_restored}Flag
CrackOn{png_headers_fixed_timeline_restored}